Scheduled Saved Search Retention

hjwang — Mon, 01 Aug 2011 02:46:01 GMT

Hi~there,

As I crawl related article, I know this can be done by adding dispatch.ttl=(int)p in savedsearches.conf and overwritten in alert_action.conf where p represents scheduled search's period, right? now i have one schedule saved search run on the 1st of each month. but i found its expired time just one day more after run time on job status. Is this normal or anything else? futhermore, if I do save job on job UI , does it mean eternal retention? next time when run this search again, will this be overwritten?

Thanks

Re: Scheduled Saved Search Retention

risgupta_splunk — Wed, 21 Sep 2016 03:38:35 GMT

Yes, the TTL setting for the alert overrides the setting in savedsearches.conf, but you should set the TTL in both places. The TTL in alert_actions.conf only applies if an alert is triggered, otherwise the TTL in savedsearches.conf applies.

In both places, you can use the p notation or just the number of seconds to save.

There are also settings for TTL in limits.conf, but those only apply to ad hoc searches.

topic Re: Scheduled Saved Search Retention in Reporting

Scheduled Saved Search Retention

Re: Scheduled Saved Search Retention